> ## Documentation Index
> Fetch the complete documentation index at: https://docs.exec.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Embed Exec in an iframe

> Let external platforms embed your Exec workspace inside an iframe so learners never leave your app or LMS.

Iframe embedding lets you host your Exec workspace inside another site — for example, a customer learning portal, internal LMS, or partner app — so learners can run roleplays, view Skills, and complete assignments without leaving the parent experience.

By default, Exec blocks all iframe embedding for security. Workspace admins turn embedding on per workspace by adding the origins that are allowed to embed the site.

<Note>
  Only [workspace admins](/platform/admin-capabilities) and workspace owners can configure iframe embedding.
</Note>

## When to use iframe embedding

Use iframe embedding when you want:

* Learners to stay inside your own product or LMS instead of opening Exec in a new tab.
* A lightweight integration that doesn't require LTI 1.3 setup or grade passback.
* Full access to the Exec UI (roleplays, Skills, Knowledge Hub, Coaching) from within another site.

If you also need single sign-on from your LMS or completion data pushed back into an LMS gradebook, use [LTI 1.3](/lti/overview) instead. See [LMS Integrations](/lms-integration) for a side-by-side comparison.

## Configure allowed origins

1. Sign in as a workspace admin and open **Settings**.
2. Go to the **Security** tab and find the **Iframe Embedding** section.
3. Add each site that should be able to embed your workspace, one origin per line:

   ```text theme={null}
   https://learn.example.com
   https://app.partner.com
   ```

   An origin is the scheme plus host (and port, if any) — no paths, no query strings, no trailing slash. Origins must use `https://`.
4. Click **Save**.

Once saved, changes propagate within about a minute. To turn embedding off, click **Disable Embedding**.

<Tip>
  You can list up to 20 origins per workspace. Add every subdomain that needs to embed Exec — `https://app.example.com` does not cover `https://learn.example.com`.
</Tip>

### Allow any origin

If you don't know the embedding site's domain in advance — for example, when partners self-serve installs — check **Allow any origin to embed this workspace**.

<Warning>
  Allowing any origin removes clickjacking protection for this workspace. Any site on the internet will be able to embed it. Only use this option if you truly can't enumerate the embedding sites, and prefer an explicit origin list whenever possible.
</Warning>

## Embed Exec on the parent site

On the site that will host Exec, add an iframe pointing at your workspace URL:

```html theme={null}
<iframe
  src="https://your-workspace.exec.com"
  allow="storage-access; camera; microphone; clipboard-write"
  style="width: 100%; height: 100%; border: 0;"
></iframe>
```

A few notes on the iframe attributes:

* **`allow="storage-access"`** is required for Safari and other browsers that block third-party cookies by default. Without it, Safari users see a popup login prompt instead of an inline sign-in.
* **`camera` and `microphone`** are required so learners can run voice roleplays inside the iframe.
* **`clipboard-write`** lets learners copy transcripts and share links.

The parent site must be served over HTTPS. Browsers reject cross-origin iframes on mixed-content pages.

## How sign-in works inside an iframe

When a learner opens the parent site for the first time:

1. Exec loads inside the iframe and checks whether the learner already has a session.
2. If not signed in, and the browser allows third-party cookies, Exec shows the normal sign-in screen inline.
3. If the browser blocks third-party cookies (default in Safari), Exec opens a small popup for sign-in. Once the learner authenticates, the popup closes and the iframe refreshes automatically.

SSO works the same way as outside an iframe — if your workspace has SSO enabled, the popup or inline flow redirects to your identity provider.

## Troubleshooting

<AccordionGroup>
  <Accordion title="The iframe shows a blank page or “refused to connect” error.">
    The embedding site's origin isn't in your allowed list. Copy the exact origin from the browser address bar (scheme + host + port, no path) and paste it into **Settings → Security → Iframe Embedding**. Changes take up to a minute to take effect.
  </Accordion>

  <Accordion title="Safari users can't sign in inside the iframe.">
    Add `allow="storage-access"` to the iframe tag on the parent site. Safari blocks third-party cookies by default, and the Storage Access API is how Exec requests permission to sign the learner in. Without this attribute, learners will see a popup sign-in instead.
  </Accordion>

  <Accordion title="Origins were saved but embedding still doesn't work.">
    Make sure the origin uses `https://` (not `http://`), has no path or trailing slash, and matches the parent site exactly. `https://example.com` and `https://www.example.com` are different origins.
  </Accordion>

  <Accordion title="Can I embed only part of the Exec UI?">
    Not today — the iframe loads the same UI as `https://your-workspace.exec.com`. You can deep-link to a specific roleplay or Skills page by pointing the `src` attribute at that URL.
  </Accordion>
</AccordionGroup>

## Getting Help

**Need help?** Contact us at [hello@exec.com](mailto:hello@exec.com) for help setting up iframe embedding or choosing between iframe and [LTI 1.3](/lti/overview).